topic Re: GoToMeeting Whitelist in Cortex XDR Discussions

GoToMeeting Whitelist

BillStrahan — Tue, 24 Nov 2020 20:21:19 GMT

Does anyone know how to whitelist the GoToMeeting download?

It is an EXE but the client agent blocks it. When I attempt to whitelist it, EVERY SINGLE download is a different hash value making it impossible to whitelist.

Thanks for any suggestions.

Re: GoToMeeting Whitelist

KanwarSingh01 — Tue, 24 Nov 2020 21:25:50 GMT

Can you please post the alert details?

You can actually make an exception based on the filename, signer or various other methods etc.. under the Invetigation tab > Exclusions.

Re: GoToMeeting Whitelist

gjenkins — Fri, 04 Dec 2020 18:26:20 GMT

Hi BillStrahan,

It would be beneficial to post the "alert source" and "alert name" values observed when executing the GoToMeeting file. Adding to the allow list, as instructed here, would only work if the "Alert Source = 'XDR Agent'" and the "Alert Name contained 'malware.'" Other alert sources and names have different instructions for creating exceptions to permit a file to run. For example, an alert with "Alert Source = 'XDR Agent'" and the "Alert Name = 'Behavioral Threat,'" would need a BTP exception rather than a whitelist to permit execution.

More information about the different ways to make exceptions can be found here: Add a New Exceptions Security Profile.

Please let us know your findings.

PS. Given that the hash changes frequently, there are two other ways to permit the GoToMeeting file to run if it is being categorized as malware, and that is by adding the signer to the Allow List Signers ('Malware Security Profile' > 'Allow List Signers,') or to a Files/Folders allow list ( 'Malware Security Profile' > 'Files/Folders in Allow List.')

Re: GoToMeeting Whitelist

dfalcon — Sun, 06 Dec 2020 18:47:56 GMT

Hi @BillStrahan -

For this very "installer," the Trusted Publisher feature was introduced over 4 years ago. The Trusted Publisher feature should allow the installer to run. I recommend contacting Support if you are seeing blocks tied to the GTM installer.

Re: GoToMeeting Whitelist

EddieRowe — Tue, 08 Dec 2020 16:54:21 GMT

Our prior AV solution began having fits with Goto products about a year ago. As paying customers we begged the LogMeIn vendor to stop changing the hash of the file each time it was downloaded to no avail. We were forced to place the vendors certificate on the allow list since this crippled the organization. We have not run into any issues with the Goto products with Cortex XDR Prevent 7.1.3 on Windows (don't do Mac/Linux).

Re: GoToMeeting Whitelist

gjenkins — Fri, 11 Dec 2020 17:19:40 GMT

Hi @BillStrahan,

Were you able to successfully add the GoToMeeting executable to the allow list using any previous suggestions?